Require user input to continue running the Splunk Phantom playbook

You can configure a task or prompt in your Splunk Phantom playbook that must be acknowledged by a user before further actions in the playbook are run. You can configure the following types of user input in a playbook:

• A manual task using a Manual Task block that must be acknowledged by a user.
• A prompt using a Prompt block that must be acknowledged by a user. You can configure a specific response type with a Prompt block.

Require user input using the Manual Task block in your playbook

Use a Manual Task block to send a message to a Splunk Phantom user or group that they must acknowledge. This is the same as manually running a task action from the Investigation menu.

To configure a manual task, perform the following tasks:

1. Drop a new block onto the playbook editor.
2. Click on the block, then select Manual Task from the block types.
3. Select an Approver from the drop-down list. If the task is assigned to a group of users, the first user to process it completes the task.
4. From the Required response time field, choose the response time in minutes.
5. In the Message box, craft a meaningful message so the users receiving the message understand what actions they must take.

Require user input using the Prompt block in your playbook

Use a Prompt block in your playbook to send a message to a user or group that they must acknowledge.

To configure a prompt, perform the following tasks:

1. Drop a new block onto the playbook editor.
2. Click on the block, and then select Prompt from the block types.
3. Select an Approver from the drop-down list. If the task is assigned to a group of users, the first user to process it completes the task.
4. From the Required response time field, choose the response time in minutes.
5. In the Message box, craft a meaningful message so the users receiving the message understand what actions they must take.
6. From the Responses drop-down list, choose the type of response required to complete the task.